The CFPB issued a proposed rule Tuesday that would make clear that data brokers are “consumer reporting agencies” under the Fair Credit Reporting Act (FCRA) when they sell certain sensitive consumer information. This would require brokers to comply with accuracy requirements, provide consumers access to their information, and maintain safeguards against misuse.

America’s Credit Unions’ legacy organizations commented on the CFPB’s request for information on the topic last November, expressing concerns over its broad nature and requesting financial institutions be specifically excluded from the “data broker” definition.  

Many of those concerns are present in the proposal released Tuesday, including:  

• The definition of consumer reports and consumer reporting agencies includes broad categories of data and activities that could inadvertently encompass credit unions or their practices when interacting with data brokers; 
• Expanding the definition of when information is “used” or “expected to be used,” which could inadvertently capture credit unions' identity verification or fraud detection activities; 
• An emphasis on the recipient's actual use of information rather than the intent of the party furnishing it, ignoring the FCRA's original intent requirement; and 
• The lack of explicit carve out exceptions for entities like credit unions that are already heavily regulated.

America’s Credit Unions wrote to CFPB Director Rohit Chopra last month requesting the CFPB delay significant regulatory activities until after the presidential transition to ensure policy alignment with the incoming administration, avoid costly legal challenges, allow for meaningful stakeholder engagement, and maintain economic stability.

Comments on the proposal are due March 5, after the new administration—and likely a new CFPB director—is in place.